Framework for exposing network activities

ABSTRACT

Systems and methods are provided for investigation network activities. Network activity information may be accessed. The network activity information may describe for an individual (1) respective relationship with one or more persons; and (2) respective activity status information indicating whether a given person has engaged in a particular activity. A network activity graph may be generated based on the network activity information. The network activity graph may include two or more nodes representing the individual and the one or more persons. Connections between the nodes may represent the respective relationships between the individual and the one or more persons. Data corresponding to the network activity graph may be presented through an interface.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation application of U.S. patentapplication Ser. No. 15/491,845, filed Apr. 19, 2017, now U.S. Pat. No.10,606,866 B1, which claims the benefit under 35 U.S.C. § 119(e) of theU.S. Provisional Application Ser. No. 62/479,041, filed Mar. 30, 2017,the content of which is hereby incorporated by reference in itsentirety.

FIELD OF THE INVENTION

This disclosure relates to approaches for surfacing, investigating, andexposing network activities.

BACKGROUND

Under conventional approaches, surfacing, investigating, and exposingnetwork activities (e.g., network of criminal activities) may requireanalysis of properties/characteristics of persons, accounts, and/orlinking traits. Finding, viewing, and linking persons/accounts/traitsmay be time consuming and very difficult. The time required and thedifficulty of finding, viewing, and linking persons/accounts/traits mayresult in inaccurate/incomplete view of network activities.

SUMMARY

Various embodiments of the present disclosure may include systems,methods, and non-transitory computer readable media configured tofacilitate investigating network activities. Various embodiments of thepresent disclosure may include systems, methods, and non-transitorycomputer readable media configured to access network activityinformation. The network activity information may describe for anindividual (1) respective relationship with one or more persons; and (2)respective activity status information indicating whether a given personhas engaged in a particular activity. A network activity graph may begenerated based on the network activity information. The networkactivity graph may include two or more nodes representing the individualand the one or more persons. Connections between the nodes may representthe respective relationships between the individual and the one or morepersons. Data corresponding to the network activity graph may bepresented through an interface.

In some embodiments, the respective relationships of the individual withthe one or more persons may include a linking entity that connects theindividual to at least one of the one or more persons.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to (1) determine a density metric for theindividual based on the respective relationships with the one or morepersons; (2) determine an association metric for the individual based onthe respective activity status information of the one or more persons;and (3) provide information describing the individual for investigationto be presented through the interface based on the density metric andthe association metric.

In some embodiments, the density metric for the individual may bedetermined based on a number of relationship loops formed by therespective relationships of the individual with the one or more personsand one or more sizes of the relationship loops.

In some embodiments, the association metric for the individual may bedetermined based on a propagation function. The association metric forthe individual may be determined further based on (1) one or moreweights associated with the one or more persons, (2) one or more weightsassociated with the respective relationships between the individual andthe one or more persons, or (3) one or more weights associated with theone or more persons and the respective relationships between theindividual and the one or more persons. The systems, methods, andnon-transitory computer readable media may be configured to assign orchange (1) at least one of the weights associated with the one or morepersons, (2) at least one of the one or more weights associated with therespective relationships between the individual and the one or morepersons, or (3) at least one of the one or more weights associated withthe one or more persons and the respective relationships between theindividual and the one or more persons.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to change an update rule by which theassociation metric is updated.

In some embodiments, the systems, methods, and non-transitory computerreadable media are configured to present a build-up user interface. Thebuild-up user interface may enable a user to (1) view a list of entitiesadded to an investigation, (2) view a list of related entities, and (3)add one or more of the related entities to the investigation. Thesystems, methods, and non-transitory computer readable media may beconfigured to render a network activity graph based on the investigationbuilt by the user.

These and other features of the systems, methods, and non-transitorycomputer readable media disclosed herein, as well as the methods ofoperation and functions of the related elements of structure and thecombination of parts and economies of manufacture, will become moreapparent upon consideration of the following description and theappended claims with reference to the accompanying drawings, all ofwhich form a part of this specification, wherein like reference numeralsdesignate corresponding parts in the various figures. It is to beexpressly understood, however, that the drawings are for purposes ofillustration and description only and are not intended as a definitionof the limits of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Certain features of various embodiments of the present technology areset forth with particularity in the appended claims. A betterunderstanding of the features and advantages of the technology will beobtained by reference to the following detailed description that setsforth illustrative embodiments, in which the principles of the inventionare utilized, and the accompanying drawings of which:

FIG. 1 illustrates an example environment for investigating networkactivities, in accordance with various embodiments.

FIGS. 2A-D illustrate example tables storing network activityinformation, in accordance with various embodiments.

FIGS. 3A-B illustrate example network activity graphs, in accordancewith various embodiments.

FIGS. 4A-B illustrate example interfaces for investigating networkactivities, in accordance with various embodiments.

FIG. 5 illustrates a flowchart of an example method, in accordance withvarious embodiments.

FIG. 6 illustrates a block diagram of an example computer system inwhich any of the embodiments described herein may be implemented.

DETAILED DESCRIPTION

A claimed solution rooted in computer technology overcomes problemsspecifically arising in the realm of computer technology. In variousimplementations, a computing system is configured to access networkactivity information. The network activity information may includeinformation that describes for an individual: (1) relationships withother persons and (2) whether the other persons have engaged in aparticular activity (e.g., criminal activity). The computing system maygenerate a network activity graph based on the network activityinformation. The network activity graph may include nodes representingpersons and connections between the nodes representing relationshipsbetween the persons. The network activity graph may include nodesrepresenting linking objects (e.g., accounts/properties) that link twoor more persons. The computing system may determine a density metric andan association metric for the individual. The density metric may bedetermined based on the individual's relationship with other persons andthe association metric may be determined based on whether the otherpersons have engaged in the particular activity. The computing systemmay surface the individual for investigation based on the density metricand the association metric. The computing system may present a build-upuser interface. The build-up user interface may enable a user to (1)view a list of entities added to an investigation, (2) view a list ofrelated entities, and (3) add one or more of the related entities to theinvestigation. The computing system may render a network activity graphbased on the investigation built by the user.

As used herein, the term “investigation” refers to a line of inquiry oranalysis to uncover one or more network activities. An investigation mayinclude one or more steps to analyze, surface, and expose networkactivities. A network activity may refer to particular action(s)performed by multiple individuals. A network activity may occur at apoint in time/a particular location or over a range of times/ranges oflocations. For example, a network activity may refer to one or moresuspicious (or criminal) activities (e.g., financial crimes) engaged inby multiple individuals. Multiple individuals may be engaged in one ormore network activities in concert and/or using one or more sharedresources (e.g., bank account). In general, an investigation may beshared by multiple users, multiple users may collaborate on a singleinvestigation via multiple client devices, individual users may havetheir own separate investigations, or individual users may work onindividual investigations via individual client devices.

The invention disclosed herein enables users to conduct investigationsof network activities using links/connections between individuals andidentification of individuals who have engaged in one or more particularactivities. The invention disclosed herein provides for an analyticaltool capable of investigating and surfacing a holistic picture ofnetwork activity from a single/few leads in a short duration of time.For example, a single lead (e.g., a person, an event, an account) may beused to build out a network of coordinated activities by using linksbetween nodes (representing entities) of a network activity graph,anomalous degrees of connectedness between the nodes, and informationregarding entities engaged in one or more particular activities. Theinitial lead(s) may come from a variety of sources (e.g., government,organization, company, individuals, network models). The approachesdisclosed herein may allow a user to expose network activities and/orpotential targets of the network activities, and allow for visualizationof entities, timeline(s) of events, and respective locations associatedwith entities to provide a holistic data picture of network activities.The results of the investigation may be shared among investigators andmay promote collaboration among investigations. New data for analysismay be flagged as alerts. An alert/stop for entities may be generated toprevent entities from further/future engagement of the particularactivities.

FIG. 1 illustrates an example environment 100 for investigating networkactivities, in accordance with various embodiments. The exampleenvironment 100 may include a computing system 102. The computing system102 may include one or more processors and memory. The processor(s) maybe configured to perform various operations by interpretingmachine-readable instructions stored in the memory. As shown in FIG. 1,in various embodiments, the computing device 102 may include an accessengine 112, a network activity graph engine 114, an analysis engine 116,an interface engine 118, and/or other engines.

In various embodiments, the access engine 112 is configured to accessnetwork activity information. Network activity information may beaccessed from one or more storage locations. A storage location mayrefer to electronic storage located within the computing system 102(e.g., integral and/or removable memory of the computing system 102),electronic storage coupled to the computing system 102, and/orelectronic storage located remotely from the computing system 102 (e.g.,electronic storage accessible to the computing system through anetwork). Network activity information may be included within a singlefile or included across multiple files. Network activity information mayinclude tables that include relational data. For example, networkactivity information may be stored as data in a database includingmultiple tables and/or information that can be accessed by a databasemanagement system/platform. The data included in the tables may providea flexible backend for the network activity investigationsystems/methods disclosed herein. The data included in the tables may beindexed and allow for fast joins to combine information included inmultiple tables. Individual and/or combined information may be providedin one or more user interfaces as disclosed herein.

Network activity information may describe for one or more individuals(1) respective relationships with one or more persons and (2) respectiveactivity status information indicating whether a given person hasengaged in one or more particular activities. Respective relationshipsof an individual with one or more persons may each include acorresponding linking entity that connects the individual to one or morepersons. An entity may refer to a living or non-living thing that isdistinct from other living or non-living things. An entity may refer agroup of living and/or non-living things that is distinct from othergroups of living and/or non-living things. For example, an entity mayrefer to an individual, an organization, a business, an account, alocation, a date, an event, and/or other distinct things. A linkingentity may refer to an entity that links individuals together or groupsof individuals together. A linking entity may refer to an entity that isshared by/among multiple individuals (or groups of individuals). Forexample, a linking entity may refer to a resource, tool, and/or account(e.g., bank account, phone number, IP address) shared by/among multipleindividuals (or groups of individuals).

Network activity information may be stored as data in multiple tables.For example, network activity information may be stored in (1) anentities table, (2) a link table, (3) an attributes table, and/or othertables/structures. The entities table may define different entities.Different entities may be differentiated within the entities table bydifferent identification codes or other markers. The entities table mayinclude information regarding the type of different entities (e.g.,individuals, linking entities). The link table may define respectiverelationships between different entities. For example, a row of a linktable may define links between two entities by providing theidentification codes of the two entities within a single row. Theentities table and the link table may include other/differentinformation. For example, the link table may include informationregarding the types of links between entities and/or the types of rolesengaged by a particular individual in a link. For example, the linktable may include information that two entities are linked by an eventtype. In another example, a link between two individuals may be based ona phone call between the two individuals and the link table may includeinformation that defines the caller and the callee.

The attributes table may include information regarding attributes ofdifferent entities. The entities may be differentiated by theiridentification codes, and the attributes table may include informationthat defines the type of attribute being defined (e.g., an individual'sattribute, a linking entity's attribute) and the values associated withthe attributes (e.g., string, number, binary). For example, theattributes table may include respective activity status informationindicating whether a given person has engaged in one or more particularactivities (e.g., a string that describes the activity engaged, a numberthat indicates the activity engaged, a binary value that indicateswhether the activity has been engaged in or not).

In some embodiments, the attributes table may store different types ofattributes for different types of entities. As an example, theattributes table may store for an individual one or more of name,address, phone number, birth date, nationality, gender, engagedactivities (identification of activity, number/percentage of activity),characteristics relating one or more investigations (e.g., suspicionlevel, amount of money/property involved, type of investigation), and/orother information. As another example, the attributes table may storefor an account one or more of identification number, status(open/closed), date, location, description, characteristics relating oneor more investigations (e.g., suspicion level, amount of money/propertyinvolved, type of investigation), owner(s) of the account, user(s) ofthe account, and/or other information. In some embodiments, one or moretables may be combined and/or divided. For example, data included withinthe attributes table may be combined with data included in the entitiestable. As another example, information regarding whether the individualshave engaged in one or more particular activities may be storedseparately (e.g., in an activities table). Other data and tables fornetwork activity information are contemplated.

Data in two or more tables may be combined to enable lead generation foran investigation. For example, data in the entities table and the linktable may be combined to create a graph of related entities as disclosedherein. Additional information, such as data in the attributes tables,may be used to augment/complement the information presented within thegraph of related entities and allow a user to find one or more entities(e.g., individuals, accounts) for investigation. Indexing of the dataincluded in the table may allow for fast joins between the data. Fastjoins may be effectuated by one or more SQL instructions/joins tocombine data from two sets of data (e.g., included in two tables). Insome embodiments, fast joins may be achieved using one or morerelationships (e.g., primary key, foreign key) between different sets ofdata. For example, the data included in the entities table and the linktable may be joined using the identification codes of the entities.Joins of data may be performed using one or more of inner join, outerjoin (left outer join, right outer join, full outer join), natural join,cross join, self-join, and/or other joins.

In some embodiments, data included in the tables, or portions thereof,may be associated with time/date. For example, a linking entity formultiple individuals may include a bank account, and the attributes, aswell as changes to the attributes, of the bank account may betime-stamped. Time-stamping at least a portion of the network activityinformation may enable tracking of changes in connections/activities ofconnected individuals and may provide additional information for leadsgeneration.

Leads generation may refer to the process of analyzing network activityinformation for one or more individuals and identifying one or moreindividuals (and/or one or more linking entities) for investigation asto whether the particular individual(s) have engaged in particularactivities (and/or particular linking entity, or entities, have beenused in particular activities). For example, leads generation mayinclude analysis of data stored in the entities table, the link table,the attributes table, and/or other tables to determine whether a networkof individuals are engaged in one or more particular activities. Leadsgeneration may allow for identification of persons/linking entities touncover one or more network(s) of persons engaged in one or moreparticular activities. Individuals may be scored (e.g., propensityscore) based on likelihood of the individuals engaging in the particularactivities. The scores may be stored in one or more tables discussedabove (e.g., in the attributes table) and/or stored in other tables(e.g., in a score table). Score of individuals may be propagated throughthe graph of related entities using connections (respectiverelationships/links) between the entities.

For example, network activity information may define six individuals andfour linking entities. The six individuals may be connected to eachother (directly and/or indirectly) through one or more linking entities.One or more individuals may be identified as having participated in anactivity of interest (e.g., one of the individuals is an identifiedparticipant in a criminal activity) and/or as having a likelihood ofhaving participated in the activity of interest (e.g., one of theindividuals is a suspect in a criminal activity). The scores (e.g.,propensity score) of the individual(s) may be proportional to thelikelihood of the individuals having engaged in the activity ofinterest. The scores of these individuals may be propagated through thegraph of related entities using the connections (respectiverelationships/links) between the individuals/linking entities.

In various embodiments, the network activity graph engine 114 isconfigured to generate one or more network activity graphs based on thenetwork activity information. A network activity graph may include agraph of related entities as defined by the network activity information(e.g., combination of data included in the entities table and the linktable). A network activity graph may include two or more nodes and edgesconnecting the nodes. The nodes of a network activity graph mayrepresent entities defined by the network activity information (e.g.,data included in entities table). For example, the nodes of a networkactivity graph may represent individuals and/or linking entities (e.g.,bank accounts, phone numbers, IP addresses). Connections (edges) betweenthe nodes may represent the respective relationships between theentities (e.g., between an individual and one or more persons).

For example, based on the network activity information defining sixindividuals and four linking entities, the network activity graph engine114 may generate a network activity graph including six nodes for sixindividuals, four nodes for linking entities, and edges between thenodes based on the respective relationships between theindividuals/linking entities. In some embodiments, the network activitygraph engine 114 may allow a user to reduce a network activity graphbased on features of interest. For example, the network activity graphengine 114 may reduce a network activity graph by removing the nodes forthe linking entities to generate a network activity graph showingpeople-to-people relationships. As another example, the network activitygraph engine 114 may allow a user to focus on relationships of certaintypes (e.g., show within the graph only links of certain types or removelinks of certain types).

In various embodiments, the analysis engine 116 is configured to analyzethe network activity information and/or the network activity graph tofacilitate investigation of network activities. The analysis engine 116may be configured to (1) determine a density metric for one or moreindividuals based on respective relationships of the individual(s) withone or more persons and (2) determine an association metric for one ormore individuals based on respective activity status information of oneor more persons.

A density metric may refer to a measure of how densely an individual(and/or persons around the individual) is connected to otherpersons/entities. Use of density metric for leads generation may enableidentification/prioritization of persons who may be engaged in a networkactivity (e.g., systematic criminal activity engaged in by/involvingmultiple persons) rather than lone actors. In some embodiments, thedensity metric for the individual may be determined based on a number ofrelationship loops formed by respective relationships of an individualwith one or more persons and one or more sizes of the relationshiploops. A relationship loop may refer to a closed cycle formed byentities/linking entities and connection between the entities/linkingentities. For example, individual within a network activity graph mayinclude person A, person B, and person C, and linking entities mayinclude linking entity A, linking entity B, and linking entity C. PersonA may be connected to person B through linking entity A. Person B may beconnected to person C through linking entity B. And person C may beconnected to Person A through linking entity C. The nodes for persons A,B, C, and linking entities A, B, C and the edges between the nodes mayform a relationship loop.

A size of a relationship loop may refer to a number of individualswithin the relationship loop, a number of linking entities within therelationship loop, a number of edges between nodes in the relationshiploop, a number of non-looping branches which extends from therelationship loop, the length of non-looping branches that extends fromthe relationship loop, and/or other characteristics relating to the sizeof the relationship loop. In some embodiments, the relationship loop maybe classified based on the types of linking entities. For example,referring to the relationship loop, discussed above, including personsA, B, C and linking entities A, B, C, the size of the relationship loopmay be determined based on three nodes corresponding to the threepersons, three nodes corresponding to the three links, a number of edgesbetween the nodes, and/or other characteristics of the relationshiploop. For example, the size of the relationship loop may correspond to alength of six (for the number of edges between the nodes).

In some embodiments, the density metric for an individual may bedetermined based on numbers and sizes of relationship loops includingthe individuals. For example, for an individual, the number and sizes ofthe relationship loops may be determined to be as follows: (1) one cycleof length four, (2) two cycles of length six, (3) two cycles of lengtheight. In some embodiments, the density metric for an individual may bedetermined based on numbers and sizes of relationship loops surroundingthe individual. For example, a density metric for an individual may bedetermined by pivoting out from the individual by a particular amount(e.g., one) and counting the number and sizes of relationship loopsincluding the individual and/or the persons at the particular distance(e.g., one) from the individual.

An association metric may refer to a measure of how likely an individualmay have participated/may be participating in one or more particularactivities. For example, an association metric may include a propensityscore as discussed herein and/or other metrics. An association metricfor an individual may allow for ranking of persons based on how thepersons are connected to another person/linking entity associated withone or more particular activities. For example, referring to connectionsbetween persons A, B, C and linking entities A, B, C discussed above,one or more individuals may be identified as having participated in anactivity of interest (e.g., one of the individuals is an identifiedparticipant in a criminal activity) and/or as having a likelihood ofhaving participated in the activity of interest (e.g., one of theindividuals is a suspect in a criminal activity). The scores of theseindividuals may refer their identification with regards to the activityof interest. The scores of these individuals may be propagated throughthe network activity graph using the connections (respectiverelationships/links) between the persons/linking entities. Thepropagation of the scores (e.g., propensity score) may depend on thenumber of links, the lengths of links, the types of links, and/or otherinformation. An individual who is connected more closely to a personwith a certain propensity score may be scored closer to the certainpropensity score than another individual who is further away. Anindividual who is connected multiple ways to a person with a certainpropensity score may be scored closer to the certain propensity scorethan another individual who is connected in fewer ways.

For example, an association metric for individuals in a network activitygraph may be determined based on pivoting. A person in the networkactivity graph may be identified as having engaged in a particularactivity and all persons around that person may be scored as havingengaged in/or have a likelihood of having engaged in the particularactivity. As another example, a linking entity within the networkactivity graph may be identified as being involved in the particularactivity and all persons connected to the linking entity may be scoredas having engaged in/or have a likelihood of having engaged in theparticular activity. The number of pivoting from the person identifiedhas having engaged in the particular activity/linking entity identifiedhas being involved in the particular activity may be changed.

As another example, an association metric for individuals in a networkactivity graph may be determined based on selective pivoting. Selectivepivoting may account for the number of individuals who have beenidentified as having engaged in a particular activity and the number ofpersons within a relationship loop. The propagation of an associationmetric (e.g., propensity score) through a network activity graph maydepend on the size of the relationship loop and how many persons withinthe loop may have been identified as having engaged in a particularactivity. For example, a linking entity may connect five individuals,one of whom has been identified as having engaged in a particularactivity. The selective pivot score for the linking entity may bedetermined to be ⅕ (one person identified as having engaged in theparticular activity out of five total persons). The propagation of theassociation metric may depend on the selective pivot score such thathigher selective pivot score leads to greater propagation (e.g., value,distance) and lower selective pivot score leads to smaller propagation(e.g., value, distance).

Selective pivoting may account for the types of linking entities bywhich individuals are connected. For example, an IP address may beassociated with thousands of individuals and a phone number may beassociated with a few individuals. The propagation of the associationmetric may depend on the types of linking entities such that the typesof linking entities associated with fewer numbers of individuals maylead to greater propagation (e.g., value, distance) and the types oflinking entities associated with greater numbers of individuals may leadto smaller propagation (e.g., value, distance). Selective pivoting mayaccount for the types of linking entities by which individuals areconnected and the number of individuals connected to the linkingentities. For example, a linking entity of type bank account withnumbers of linked individuals less than eight may have an update scoreweight (defining impact on association metric propagation) of 0.8. Alinking entity corresponding to an IP address with a number of linkedindividuals less than fifty may have an update score weight of 0.6.Other combinations of linking entity types, numbers of linkedindividuals, and impact on association metric propagation arecontemplated.

In some embodiments, an association metric for an individual may bedetermined based on a propagation function. A propagation function mayalter/propagate association metrics for individuals through a networkactivity graph using a flexible framework. For example, a propagationfunction may include flexible label propagation and/or other propagationmethods. A propagation function may use one or more label propagationalgorithms to determine/update association metrics for differentindividuals. A label propagation algorithm may determine associationmetrics for individuals that capture the identification of individual(s)as having engaged in one or more particular activities as well assmoothing over nearby relationships. A label propagation algorithm mayrandomly assign a score (e.g., propensity score) to all individuals andapply updates to the scores based on known identification of individualsthat engaged in one or more particular activities. Updates may includeiterative updates, incremental updates, and/or other updates. Updatesmay stop when the updates have converged (e.g., when the differencebetween the prior value and the updated value of the association metricis below a threshold or the derivative of loss is less than some value).

In some embodiments, an association metric for an individual may bedetermined further based on (1) one or more weights associated with theone or more persons, (2) one or more weights associated with therespective relationships between the individual and the one or morepersons, or (3) one or more weights associated with the one or morepersons and the respective relationships between the individual and theone or more persons. For example, the flexible framework for propagatingassociation metric may enable a user to assign weights to differententities (e.g., individuals, linking entities) and/or connectionsbetween entities to affect the strength of propagation through a networkactivity graph.

In some embodiments, the analysis engine 116 may be configured to assignor change (1) at least one of the weights associated with the one ormore persons, (2) at least one of the one or more weights associatedwith the respective relationships between the individual and the one ormore persons, or (3) at least one of the one or more weights associatedwith the one or more persons and the respective relationships betweenthe individual and the one or more persons. For example, the flexibleframework for propagating association metric may enable a user to tuneweights of different entities (e.g., individuals, linking entities)and/or connections between entities to affect the strength ofpropagation through a network activity graph. As another example, theflexible framework for propagating association metric may enable a userto define the extent to which an association metric may propagatethrough a network activity graph (e.g., define the extent of boundaryfor propagation (e.g., three pivots)).

The association metric for the individual may be updated. The updatesmay be based on time (e.g., period basis), changes in the networkactivity information (e.g., inclusion of new entity, changes inidentification of individuals having engaged in a particular activity),and/or based on user input (e.g., user command to update the associationmetric). New/changed data in the network activity information may beflagged for review by one or more users. In some embodiments, one ormore rules by which the association metric is updated/propagated may bechanged. Changes in the rule(s) may include changes in the propagationfunction/label propagation algorithm(s), changes in the extent ofboundary for propagation, changes in the data used, changes in weights,and/or other changes. A flexible framework for determining associationmetric may enable a user to easily use variance of association metricpropagation (e.g., objective function, update rule) and/or variance ofthe data set for analysis.

The analysis engine 116 may use a combination of density metric andassociation metric to identify individuals/linking entities forinvestigation for particular activities. The analysis engine 116 mayidentify individuals/linking entities as part of leads generation.Combination of density metric and association metric may includeaggregation of the density metric and the association metric. Forexample, a combination of a density metric and an association metric mayinclude average or sum of the two metrics. Other combinations of densitymetric and association metric are contemplated. The combination ofdensity metric and association metric for leads generation may enablethe analysis engine 116 to prioritize individuals (1) strongly connectedto persons known to have engaged in one or more particular activitiesand (2) located in a dense region of the network activity graph.

In various embodiments, the interface engine 118 is configured topresent data corresponding to one or more network activity graphsthrough one or more interfaces. The data may include informationdescribing one or more individuals/linking entities for investigationbased on the density metric and the association metric. The interfaceengine 118 may present data that identifies one or moreindividuals/linking entities for investigation of particular activities(e.g., leads generation).

In some embodiments, the interface engine 118 may be configured topresent a build-up user interface. A build-up user interface may enablea user to (1) view a list of entities added to an investigation, (2)view a list of related entities, and (3) add one or more relatedentities to the investigation. The build-up user interface may includeoptions to enable a user to choose to create a new investigation, workon an existing investigation, or save an investigation. The build-upuser interface may include a first region that display entities added toan investigation and a second region that lists attributes of one ormore entities (responsive to a user choosing one or more entities addedto the investigation in the first region). The build-up user interfacemay include a third region that display one or more related entities(responsive to a user choosing one or more attributes in the secondregion). The build-up user interface may include options to allow theuser to add one or more related entities to the investigation. Thebuild-up user interface may include a searching function that enables auser to search for a particular individual (e.g., individual added to aninvestigation or potentially being added to the investigation). Thebuild-up user interface may include other/different regions.

The data included in the network activity information may be indexed toallow for fast joins and presentation within one or more interfacespresented by the interface engine 118. Indices of data included intables of the network activity information may be generated on the fly,at periodic intervals, based on user command, based on changes in thenetwork activity information, and/or other information. For example, anindex for searching of entities may be generated and stored in responseto searches so that subsequent search results may be presented morequickly. The entities table, the attributes table, the link table,and/or other tables may be used to provide the information within one ormore interfaces. One or more interfaces presented by the interfaceengine may enable a user to change one or more values of the networkactivity information. Changes made by a user through one or moreinterfaces (e.g., addition of an individual to an investigation, markingof an individual/linking entity as potentially having engaged in aparticular activity) may be reflected in one or more tables of thenetwork activity information.

In some embodiments, the interface engine 118 may be configured torender one or more network activity graphs based on investigation(s)built by a user. For example, the interface engine 118 may render anetwork activity graph based on the entities table and the link table.The network activity graph may be augmented/complemented with additionalinformation, such as based on data in the attributes table. In someembodiments, the interface engine 118 may be configured to change theentities/links included in the network activity graph based on a user'sinteraction with the network activity graph (e.g., removing a node,creating a new connection between nodes).

In some embodiments, the interface engine 118 may be configured toprovide information relating to one or more entities/connections betweenentities included in a network activity graph. For example, theinterface engine 118 may provide a timeline associated with changes in anetwork activity graph, maps of locations relating to the entities inthe network activity graph, and/or other information relating to one ormore entities/connections between entities included in the networkactivity graph. In some embodiments, the interface engine 118 may beconfigured to provide summary information for an investigation. Thesummary information may include aggregated statistics and/or trends in aparticular area of a network activity graph. For example, the summaryinformation may include (1) a list of entities added to aninvestigation, (2) one or more characteristics relating theinvestigation (e.g., amount of money/property involved, type ofinvestigation), (3) times/locations relating to the network activitygraph, and/or other information. In some embodiments, the interfaceengine 118 may enable a user to generate an alert/stop for one or moreindividuals/linking entities, which may be used to prevent theindividuals/linking entities from further/future engagement of theparticular activities.

FIGS. 2A-D illustrate example tables storing network activityinformation, in accordance with various embodiments. As shown in FIG.2A, an entities table 210 may define different entities. Differententities may be differentiated within the entities table 210 bydifferent identification codes (ID). The entities table 210 may includeinformation regarding the type of different entities (e.g., person, linkA, link B, link C, link D). As shown in FIG. 2B, a link table 220 maydefine respective relationships between different entities (e.g.,defined in the entities table 210). For example, a row of the link table220 may define links between two entities by providing theidentification codes of the two entities within a single row. Forexample, the first row of the link table 220 may indicate that a person(ID 1001) and a linking entity (ID 1101) are linked. The entities table210 and the link table 220 may include other/different information. Forexample, the link table 220 may include information regarding the typesof links between entities and/or the types of role engaged by aparticular individual in a link. For example, the link table 220 mayinclude information that define the type of link between a person (ID1001) and a linking entity (ID 1101) as Linking A. As another example, alink between two individuals may be established based on a call betweenthe two individuals and the link table 220 may include information thatdefines the caller and the callee.

As shown in FIG. 2C, an attributes table 230 may include informationregarding attributes of different entities (e.g., defined in theentities table 210). The entities may be differentiated by theiridentification codes (ID), and the attributes table 230 may includeinformation that defines the type of attribute being defined (e.g.,person attributes, link attributes) and the values associated with theattributes (e.g., string, number, binary). For example, the attributestable 230 may include respective activity status information indicatingwhether a given person has engaged in one or more particular activities(e.g., string that describes the activity engaged, number that indicatesthe activity engaged, binary that indicates whether the activity hasbeen engaged in or not).

In some embodiments, the attributes table 230 may store different typesof attributes for different types of entities. For example, theattributes table 230 may store for an individual one or more of name,address, phone number, birth date, nationality, gender, engagedactivities (identification of activity, number/percentage of activity),characteristics relating one or more investigations (e.g., suspicionlevel, amount of money/property involved, type of investigation), and/orother information. As another example, the attributes table 230 maystore for an account (a linking entity) one or more of identificationnumber, status (open/closed), date, location, description,characteristics relating one or more investigations (e.g., suspicionlevel, amount of money/property involved, type of investigation),owner(s) of the account, user(s) of the account, and/or otherinformation.

As shown in FIG. 2D, a score table 240 may include information regardingassociation metrics of different entities (e.g., defined in the entitiestable 210). The entities may be differentiated by their identificationcodes (ID), and the score table 240 may include information/values ofthe association metric for the different entities. Association metricmay include one or more numbers, characters, and/or combinations ofnumbers and characters.

In some embodiments, one or more tables 210, 220, 230, 240 may becombined and/or divided. For example, data included within theattributes table 230 may be combined with data included in the entitiestable 210. As another example, information regarding whether theindividuals have engaged in one or more particular activities may bestored separately (e.g., in an activities table). Other data and tablesare contemplated.

FIGS. 3A-B illustrate example network activity graphs 300, 350, inaccordance with various embodiments. The network activity graph 300 maybe generated by the network activity graph engine 114 based on networkactivity information (e.g., data included in the tables 210, 220). Asshown in FIG. 3A, the network activity graph 300 may include nodesrepresenting individuals (person A 301, person B 302, person C 303,person D 304, person E 305, person F 306) and nodes representing linkingentities (linking entity A 311, linking entity B 312, linking entity C313, linking entity D 314). The nodes may be connected by edges,indicating relationship between the respective nodes/entities. Forexample, person A 301 may correspond to ID 1001 in the entitles table210 and the link table 220, person B 302 may correspond to ID 1002 inthe entitles table 210 and the link table 220, person C 303 maycorrespond to ID 1003 in the entitles table 210 and the link table 220,person D 304 may correspond to ID 1004 in the entitles table 210 and thelink table 220, person E 305 may correspond to ID 1005 in the entitlestable 210 and the link table 220, and person F 306 may correspond to ID1006 in the entitles table 210 and the link table 220. Linking entity A311 may correspond to ID 1101 in the entitles table 210 and the linktable 220, linking entity B 312 may correspond to ID 1102 in theentitles table 210 and the link table 220, linking entity C 313 maycorrespond to ID 1103 in the entitles table 210 and the link table 220,and linking entity D 314 may correspond to ID 1104 in the entitles table210 and the link table 220. Based on the data included in the tables210, 220, person A 301, person B 302, and person D 304 may be linked bythe linking entity A 311. Person B 302, person C 303, person E 305, andperson F 306 may be linked by the linking entity B 312. Person A 301,person C 303, and person F 306 may be linked by the linking entity C313. Person A 301 and person D 304 may be linked by the linking entity D314.

FIG. 3B shows the network activity graph 350, which may include areduction of the network activity graph 300 by the network activitygraph engine 114 to remove the nodes for the linking entities 311, 312,313, 314. The network activity graph 350 shows people-to-peoplerelationships for persons 301, 302, 303, 204, 305, 306. The networkactivity graph 350 shows that person A 301 is linked to person B 302,person C 303, person D 304, and person F 306; person B 302 is linked toperson A 301, person C 303, person D 304, person E 305, and person F306; person C 303 is linked to person A 301, person B 302, person E 305,and person F 306; person D 304 is linked to person A 301 and person B302; person E 305 is linked to person B 302, person C 303, and person F306; and person F 306 is linked person A 301, person B 302, person C303, and person E 305.

FIGS. 4A-B illustrate example interfaces 400, 450 for investigatingnetwork activities, in accordance with various embodiments. Datacorresponding to one or more network activity graphs may be presentedthrough the interfaces 400, 450 by the interface engine 118. As shown inFIG. 4A, the interface 400 includes a search field 402, an entities ininvestigation region 404, an attributes region 406, a linked entitiesregion 408, and a render option 410. The interface 400 may enable a userto (1) view a list of entities added to an investigation, (2) view alist of related entities, and (3) add one or more related entities tothe investigation. The interface 400 may include options to enable auser to choose to create a new investigation, work on an existinginvestigation, or save an investigation.

The entities in investigation region 404 may display entities added toan investigation. The attributes region 406 may display attributes ofone or more entities listed in the entities in investigation region 404.For example, the attributes region 406 may display attributes of one ormore entities selected by a user within the entities in investigationregion 404. The linked entities region 408 may display one or morerelated entities. For example, a user may select a particular individualdisplayed in the entities in investigation region 404. The attributesregion 406 may display the attributes of the particular individual.Responsive to a user's selection of one or more attributes of theparticular individuals, the linked entities region 408 may displayentities who are linked to the particular individual by the particularattribute(s) (e.g., clicking on a bank account of the particularindividual may display a list of individuals also associated with thebank account). The interface 400 may include options to allow the userto add one or more related entities to the investigation.

The interface 400 may include a searching field 402 that enables a userto search for a particular individual (e.g., added to an investigation,for potential addition to the investigation). The interface 400 mayinclude the render option 410, which allows a user to generate a networkactivity graph for the investigation. In some embodiments, the interface400 may include options for a user to generate an alert/stop for one ormore individuals/linking entities, which may be used to prevent theindividuals/linking entities from further/future engagement of one ormore particular activities. The interface 400 may includeother/different regions.

As shown in FIG. 4B, the interface 450 includes an investigation nameregion 452, a summary region 454, a list of entities region 456, and apresentation region 458. The investigation name region 452 may displaythe name of the investigation being shown in the interface 450. Thesummary region 454 may display summary information for theinvestigation. Summary information may include aggregated statisticsand/or trends relating to the investigation. For example, the summaryinformation may include (1) a number of entities added to theinvestigation, (2) one or more characteristics relating theinvestigations (e.g., amount of money/property involved, type ofinvestigation), and/or (3) times/locations relating to a networkactivity graph, and/or other information. The list of entities region456 may list entities added to the investigation. The presentationregion 458 may display one or more visual information relating to theinvestigation. For example, as shown in FIG. 4B, the presentation region458 may display a network activity graph for the investigation. Asanother example, the presentation region 458 may display (e.g., inaddition to or in place of the network activity graph), one or more mapsshowing locations corresponding to the entities in the investigationand/or timeline of events to provide a holistic picture of theinvestigation. Other presentation of visual information arecontemplated.

FIG. 5 illustrates a flowchart of an example method 500, according tovarious embodiments of the present disclosure. The method 500 may beimplemented in various environments including, for example, theenvironment 100 of FIG. 1. The operations of method 500 presented beloware intended to be illustrative. Depending on the implementation, theexample method 500 may include additional, fewer, or alternative stepsperformed in various orders or in parallel. The example method 500 maybe implemented in various computing systems or devices including one ormore processors.

At block 502, network activity information may be accessed. The networkactivity information may describe for an individual (1) respectiverelationships with one or more persons; and (2) respective activitystatus information of one or more persons, the respective activitystatus information indicating whether a given person has engaged in aparticular activity. At block 504, a network activity graph may begenerated based on the network activity information. The networkactivity graph may include two or more nodes representing the individualand one or more persons, and connections between two or more nodesrepresenting respective relationships between the individual and one ormore persons. At block 506, a density metric and an association metricfor the individual may be determined. The density metric may bedetermined based on the respective relationships of the individual withone or more persons. The association metric may be determined based onthe respective activity status information of the one or more persons.At block 508, data corresponding to the network activity graph may beprovided to be presented through an interface. The data may includeinformation describing the individual for investigation.

Hardware Implementation

The techniques described herein are implemented by one or morespecial-purpose computing devices. The special-purpose computing devicesmay be hard-wired to perform the techniques, or may include circuitry ordigital electronic devices such as one or more application-specificintegrated circuits (ASICs) or field programmable gate arrays (FPGAs)that are persistently programmed to perform the techniques, or mayinclude one or more hardware processors programmed to perform thetechniques pursuant to program instructions in firmware, memory, otherstorage, or a combination. Such special-purpose computing devices mayalso combine custom hard-wired logic, ASICs, or FPGAs with customprogramming to accomplish the techniques. The special-purpose computingdevices may be desktop computer systems, server computer systems,portable computer systems, handheld devices, networking devices or anyother device or combination of devices that incorporate hard-wiredand/or program logic to implement the techniques.

Computing device(s) are generally controlled and coordinated byoperating system software, such as iOS, Android, Chrome OS, Windows XP,Windows Vista, Windows 7, Windows 8, Windows Server, Windows CE, Unix,Linux, SunOS, Solaris, iOS, Blackberry OS, VxWorks, or other compatibleoperating systems. In other embodiments, the computing device may becontrolled by a proprietary operating system. Conventional operatingsystems control and schedule computer processes for execution, performmemory management, provide file system, networking, I/O services, andprovide a user interface functionality, such as a graphical userinterface (“GUI”), among other things.

FIG. 6 is a block diagram that illustrates a computer system 600 uponwhich any of the embodiments described herein may be implemented. Thecomputer system 600 includes a bus 602 or other communication mechanismfor communicating information, one or more hardware processors 604coupled with bus 602 for processing information. Hardware processor(s)604 may be, for example, one or more general purpose microprocessors.

The computer system 600 also includes a main memory 606, such as arandom access memory (RAM), cache and/or other dynamic storage devices,coupled to bus 602 for storing information and instructions to beexecuted by processor 604. Main memory 606 also may be used for storingtemporary variables or other intermediate information during executionof instructions to be executed by processor 604. Such instructions, whenstored in storage media accessible to processor 604, render computersystem 600 into a special-purpose machine that is customized to performthe operations specified in the instructions.

The computer system 600 further includes a read only memory (ROM) 608 orother static storage device coupled to bus 602 for storing staticinformation and instructions for processor 604. A storage device 610,such as a magnetic disk, optical disk, or USB thumb drive (Flash drive),etc., is provided and coupled to bus 602 for storing information andinstructions.

The computer system 600 may be coupled via bus 602 to a display 612,such as a cathode ray tube (CRT) or LCD display (or touch screen), fordisplaying information to a computer user. An input device 614,including alphanumeric and other keys, is coupled to bus 602 forcommunicating information and command selections to processor 604.Another type of user input device is cursor control 616, such as amouse, a trackball, or cursor direction keys for communicating directioninformation and command selections to processor 604 and for controllingcursor movement on display 612. This input device typically has twodegrees of freedom in two axes, a first axis (e.g., x) and a second axis(e.g., y), that allows the device to specify positions in a plane. Insome embodiments, the same direction information and command selectionsas cursor control may be implemented via receiving touches on a touchscreen without a cursor.

The computing system 600 may include a user interface module toimplement a GUI that may be stored in a mass storage device asexecutable software codes that are executed by the computing device(s).This and other modules may include, by way of example, components, suchas software components, object-oriented software components, classcomponents and task components, processes, functions, attributes,procedures, subroutines, segments of program code, drivers, firmware,microcode, circuitry, data, databases, data structures, tables, arrays,and variables.

In general, the word “module,” as used herein, refers to logic embodiedin hardware or firmware, or to a collection of software instructions,possibly having entry and exit points, written in a programminglanguage, such as, for example, Java, C or C++. A software module may becompiled and linked into an executable program, installed in a dynamiclink library, or may be written in an interpreted programming languagesuch as, for example, BASIC, Perl, or Python. It will be appreciatedthat software modules may be callable from other modules or fromthemselves, and/or may be invoked in response to detected events orinterrupts. Software modules configured for execution on computingdevices may be provided on a computer readable medium, such as a compactdisc, digital video disc, flash drive, magnetic disc, or any othertangible medium, or as a digital download (and may be originally storedin a compressed or installable format that requires installation,decompression or decryption prior to execution). Such software code maybe stored, partially or fully, on a memory device of the executingcomputing device, for execution by the computing device. Softwareinstructions may be embedded in firmware, such as an EPROM. It will befurther appreciated that hardware modules may be comprised of connectedlogic units, such as gates and flip-flops, and/or may be comprised ofprogrammable units, such as programmable gate arrays or processors. Themodules or computing device functionality described herein arepreferably implemented as software modules, but may be represented inhardware or firmware. Generally, the modules described herein refer tological modules that may be combined with other modules or divided intosub-modules despite their physical organization or storage.

The computer system 600 may implement the techniques described hereinusing customized hard-wired logic, one or more ASICs or FPGAs, firmwareand/or program logic which in combination with the computer systemcauses or programs computer system 600 to be a special-purpose machine.According to one embodiment, the techniques herein are performed bycomputer system 600 in response to processor(s) 604 executing one ormore sequences of one or more instructions contained in main memory 606.Such instructions may be read into main memory 606 from another storagemedium, such as storage device 610. Execution of the sequences ofinstructions contained in main memory 606 causes processor(s) 604 toperform the process steps described herein. In alternative embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions.

The term “non-transitory media,” and similar terms, as used hereinrefers to any media that store data and/or instructions that cause amachine to operate in a specific fashion. Such non-transitory media maycomprise non-volatile media and/or volatile media. Non-volatile mediaincludes, for example, optical or magnetic disks, such as storage device610. Volatile media includes dynamic memory, such as main memory 606.Common forms of non-transitory media include, for example, a floppydisk, a flexible disk, hard disk, solid state drive, magnetic tape, orany other magnetic data storage medium, a CD-ROM, any other optical datastorage medium, any physical medium with patterns of holes, a RAM, aPROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip orcartridge, and networked versions of the same.

Non-transitory media is distinct from but may be used in conjunctionwith transmission media. Transmission media participates in transferringinformation between non-transitory media. For example, transmissionmedia includes coaxial cables, copper wire and fiber optics, includingthe wires that comprise bus 602. Transmission media can also take theform of acoustic or light waves, such as those generated duringradio-wave and infra-red data communications.

Various forms of media may be involved in carrying one or more sequencesof one or more instructions to processor 604 for execution. For example,the instructions may initially be carried on a magnetic disk or solidstate drive of a remote computer. The remote computer can load theinstructions into its dynamic memory and send the instructions over atelephone line using a modem. A modem local to computer system 600 canreceive the data on the telephone line and use an infra-red transmitterto convert the data to an infra-red signal. An infra-red detector canreceive the data carried in the infra-red signal and appropriatecircuitry can place the data on bus 602. Bus 602 carries the data tomain memory 606, from which processor 604 retrieves and executes theinstructions. The instructions received by main memory 606 may retrievesand executes the instructions. The instructions received by main memory606 may optionally be stored on storage device 610 either before orafter execution by processor 604.

The computer system 600 also includes a communication interface 618coupled to bus 602. Communication interface 618 provides a two-way datacommunication coupling to one or more network links that are connectedto one or more local networks. For example, communication interface 618may be an integrated services digital network (ISDN) card, cable modem,satellite modem, or a modem to provide a data communication connectionto a corresponding type of telephone line. As another example,communication interface 618 may be a local area network (LAN) card toprovide a data communication connection to a compatible LAN (or WANcomponent to communicated with a WAN). Wireless links may also beimplemented. In any such implementation, communication interface 618sends and receives electrical, electromagnetic or optical signals thatcarry digital data streams representing various types of information.

A network link typically provides data communication through one or morenetworks to other data devices. For example, a network link may providea connection through local network to a host computer or to dataequipment operated by an Internet Service Provider (ISP). The ISP inturn provides data communication services through the world wide packetdata communication network now commonly referred to as the “Internet”.Local network and Internet both use electrical, electromagnetic oroptical signals that carry digital data streams. The signals through thevarious networks and the signals on network link and throughcommunication interface 618, which carry the digital data to and fromcomputer system 600, are example forms of transmission media.

The computer system 600 can send messages and receive data, includingprogram code, through the network(s), network link and communicationinterface 618. In the Internet example, a server might transmit arequested code for an application program through the Internet, the ISP,the local network and the communication interface 618.

The received code may be executed by processor 604 as it is received,and/or stored in storage device 610, or other non-volatile storage forlater execution.

Each of the processes, methods, and algorithms described in thepreceding sections may be embodied in, and fully or partially automatedby, code modules executed by one or more computer systems or computerprocessors comprising computer hardware. The processes and algorithmsmay be implemented partially or wholly in application-specificcircuitry.

The various features and processes described above may be usedindependently of one another, or may be combined in various ways. Allpossible combinations and sub-combinations are intended to fall withinthe scope of this disclosure. In addition, certain method or processblocks may be omitted in some implementations. The methods and processesdescribed herein are also not limited to any particular sequence, andthe blocks or states relating thereto can be performed in othersequences that are appropriate. For example, described blocks or statesmay be performed in an order other than that specifically disclosed, ormultiple blocks or states may be combined in a single block or state.The example blocks or states may be performed in serial, in parallel, orin some other manner. Blocks or states may be added to or removed fromthe disclosed example embodiments. The example systems and componentsdescribed herein may be configured differently than described. Forexample, elements may be added to, removed from, or rearranged comparedto the disclosed example embodiments.

Conditional language, such as, among others, “can,” “could,” “might,” or“may,” unless specifically stated otherwise, or otherwise understoodwithin the context as used, is generally intended to convey that certainembodiments include, while other embodiments do not include, certainfeatures, elements and/or steps. Thus, such conditional language is notgenerally intended to imply that features, elements and/or steps are inany way required for one or more embodiments or that one or moreembodiments necessarily include logic for deciding, with or without userinput or prompting, whether these features, elements and/or steps areincluded or are to be performed in any particular embodiment.

Any process descriptions, elements, or blocks in the flow diagramsdescribed herein and/or depicted in the attached figures should beunderstood as potentially representing modules, segments, or portions ofcode which include one or more executable instructions for implementingspecific logical functions or steps in the process. Alternateimplementations are included within the scope of the embodimentsdescribed herein in which elements or functions may be deleted, executedout of order from that shown or discussed, including substantiallyconcurrently or in reverse order, depending on the functionalityinvolved, as would be understood by those skilled in the art.

It should be emphasized that many variations and modifications may bemade to the above-described embodiments, the elements of which are to beunderstood as being among other acceptable examples. All suchmodifications and variations are intended to be included herein withinthe scope of this disclosure. The foregoing description details certainembodiments of the invention. It will be appreciated, however, that nomatter how detailed the foregoing appears in text, the invention can bepracticed in many ways. As is also stated above, it should be noted thatthe use of particular terminology when describing certain features oraspects of the invention should not be taken to imply that theterminology is being re-defined herein to be restricted to including anyspecific characteristics of the features or aspects of the inventionwith which that terminology is associated. The scope of the inventionshould therefore be construed in accordance with the appended claims andany equivalents thereof.

Engines, Components, and Logic

Certain embodiments are described herein as including logic or a numberof components, engines, or mechanisms. Engines may constitute eithersoftware engines (e.g., code embodied on a machine-readable medium) orhardware engines. A “hardware engine” is a tangible unit capable ofperforming certain operations and may be configured or arranged in acertain physical manner. In various example embodiments, one or morecomputer systems (e.g., a standalone computer system, a client computersystem, or a server computer system) or one or more hardware engines ofa computer system (e.g., a processor or a group of processors) may beconfigured by software (e.g., an application or application portion) asa hardware engine that operates to perform certain operations asdescribed herein.

In some embodiments, a hardware engine may be implemented mechanically,electronically, or any suitable combination thereof. For example, ahardware engine may include dedicated circuitry or logic that ispermanently configured to perform certain operations. For example, ahardware engine may be a special-purpose processor, such as aField-Programmable Gate Array (FPGA) or an Application SpecificIntegrated Circuit (ASIC). A hardware engine may also includeprogrammable logic or circuitry that is temporarily configured bysoftware to perform certain operations. For example, a hardware enginemay include software executed by a general-purpose processor or otherprogrammable processor. Once configured by such software, hardwareengines become specific machines (or specific components of a machine)uniquely tailored to perform the configured functions and are no longergeneral-purpose processors. It will be appreciated that the decision toimplement a hardware engine mechanically, in dedicated and permanentlyconfigured circuitry, or in temporarily configured circuitry (e.g.,configured by software) may be driven by cost and time considerations.

Accordingly, the phrase “hardware engine” should be understood toencompass a tangible entity, be that an entity that is physicallyconstructed, permanently configured (e.g., hardwired), or temporarilyconfigured (e.g., programmed) to operate in a certain manner or toperform certain operations described herein. As used herein,“hardware-implemented engine” refers to a hardware engine. Consideringembodiments in which hardware engines are temporarily configured (e.g.,programmed), each of the hardware engines need not be configured orinstantiated at any one instance in time. For example, where a hardwareengine comprises a general-purpose processor configured by software tobecome a special-purpose processor, the general-purpose processor may beconfigured as respectively different special-purpose processors (e.g.,comprising different hardware engines) at different times. Softwareaccordingly configures a particular processor or processors, forexample, to constitute a particular hardware engine at one instance oftime and to constitute a different hardware engine at a differentinstance of time.

Hardware engines can provide information to, and receive informationfrom, other hardware engines. Accordingly, the described hardwareengines may be regarded as being communicatively coupled. Where multiplehardware engines exist contemporaneously, communications may be achievedthrough signal transmission (e.g., over appropriate circuits and buses)between or among two or more of the hardware engines. In embodiments inwhich multiple hardware engines are configured or instantiated atdifferent times, communications between such hardware engines may beachieved, for example, through the storage and retrieval of informationin memory structures to which the multiple hardware engines have access.For example, one hardware engine may perform an operation and store theoutput of that operation in a memory device to which it iscommunicatively coupled. A further hardware engine may then, at a latertime, access the memory device to retrieve and process the storedoutput. Hardware engines may also initiate communications with input oroutput devices, and can operate on a resource (e.g., a collection ofinformation).

The various operations of example methods described herein may beperformed, at least partially, by one or more processors that aretemporarily configured (e.g., by software) or permanently configured toperform the relevant operations. Whether temporarily or permanentlyconfigured, such processors may constitute processor-implemented enginesthat operate to perform one or more operations or functions describedherein. As used herein, “processor-implemented engine” refers to ahardware engine implemented using one or more processors.

Similarly, the methods described herein may be at least partiallyprocessor-implemented, with a particular processor or processors beingan example of hardware. For example, at least some of the operations ofa method may be performed by one or more processors orprocessor-implemented engines. Moreover, the one or more processors mayalso operate to support performance of the relevant operations in a“cloud computing” environment or as a “software as a service” (SaaS).For example, at least some of the operations may be performed by a groupof computers (as examples of machines including processors), with theseoperations being accessible via a network (e.g., the Internet) and viaone or more appropriate interfaces (e.g., an Application ProgramInterface (API)).

The performance of certain of the operations may be distributed amongthe processors, not only residing within a single machine, but deployedacross a number of machines. In some example embodiments, the processorsor processor-implemented engines may be located in a single geographiclocation (e.g., within a home environment, an office environment, or aserver farm). In other example embodiments, the processors orprocessor-implemented engines may be distributed across a number ofgeographic locations.

Language

Throughout this specification, plural instances may implementcomponents, operations, or structures described as a single instance.Although individual operations of one or more methods are illustratedand described as separate operations, one or more of the individualoperations may be performed concurrently, and nothing requires that theoperations be performed in the order illustrated. Structures andfunctionality presented as separate components in example configurationsmay be implemented as a combined structure or component. Similarly,structures and functionality presented as a single component may beimplemented as separate components. These and other variations,modifications, additions, and improvements fall within the scope of thesubject matter herein.

Although an overview of the subject matter has been described withreference to specific example embodiments, various modifications andchanges may be made to these embodiments without departing from thebroader scope of embodiments of the present disclosure. Such embodimentsof the subject matter may be referred to herein, individually orcollectively, by the term “invention” merely for convenience and withoutintending to voluntarily limit the scope of this application to anysingle disclosure or concept if more than one is, in fact, disclosed.

The embodiments illustrated herein are described in sufficient detail toenable those skilled in the art to practice the teachings disclosed.Other embodiments may be used and derived therefrom, such thatstructural and logical substitutions and changes may be made withoutdeparting from the scope of this disclosure. The Detailed Description,therefore, is not to be taken in a limiting sense, and the scope ofvarious embodiments is defined only by the appended claims, along withthe full range of equivalents to which such claims are entitled.

It will be appreciated that an “engine,” “system,” “data store,” and/or“database” may comprise software, hardware, firmware, and/or circuitry.In one example, one or more software programs comprising instructionscapable of being executable by a processor may perform one or more ofthe functions of the engines, data stores, databases, or systemsdescribed herein. In another example, circuitry may perform the same orsimilar functions. Alternative embodiments may comprise more, less, orfunctionally equivalent engines, systems, data stores, or databases, andstill be within the scope of present embodiments. For example, thefunctionality of the various systems, engines, data stores, and/ordatabases may be combined or divided differently.

“Open source” software is defined herein to be source code that allowsdistribution as source code as well as compiled form, with awell-publicized and indexed means of obtaining the source, optionallywith a license that allows modifications and derived works.

The data stores described herein may be any suitable structure (e.g., anactive database, a relational database, a self-referential database, atable, a matrix, an array, a flat file, a documented-oriented storagesystem, a non-relational No-SQL system, and the like), and may becloud-based or otherwise.

As used herein, the term “or” may be construed in either an inclusive orexclusive sense. Moreover, plural instances may be provided forresources, operations, or structures described herein as a singleinstance. Additionally, boundaries between various resources,operations, engines, engines, and data stores are somewhat arbitrary,and particular operations are illustrated in a context of specificillustrative configurations. Other allocations of functionality areenvisioned and may fall within a scope of various embodiments of thepresent disclosure. In general, structures and functionality presentedas separate resources in the example configurations may be implementedas a combined structure or resource. Similarly, structures andfunctionality presented as a single resource may be implemented asseparate resources. These and other variations, modifications,additions, and improvements fall within a scope of embodiments of thepresent disclosure as represented by the appended claims. Thespecification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense.

Conditional language, such as, among others, “can,” “could,” “might,” or“may,” unless specifically stated otherwise, or otherwise understoodwithin the context as used, is generally intended to convey that certainembodiments include, while other embodiments do not include, certainfeatures, elements and/or steps. Thus, such conditional language is notgenerally intended to imply that features, elements and/or steps are inany way required for one or more embodiments or that one or moreembodiments necessarily include logic for deciding, with or without userinput or prompting, whether these features, elements and/or steps areincluded or are to be performed in any particular embodiment.

Although the invention has been described in detail for the purpose ofillustration based on what is currently considered to be the mostpractical and preferred implementations, it is to be understood thatsuch detail is solely for that purpose and that the invention is notlimited to the disclosed implementations, but, on the contrary, isintended to cover modifications and equivalent arrangements that arewithin the spirit and scope of the appended claims. For example, it isto be understood that the present invention contemplates that, to theextent possible, one or more features of any embodiment can be combinedwith one or more features of any other embodiment.

The invention claimed is:
 1. A system comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the system to perform: accessing relational information, the relational information comprising, for a first entity: respective relationships with one or more second entities; and respective status information of the one or more second entities; determining a second entity, of the one or more second entities, having a verified attribute in relation to a particular activity; determining a nonhuman entity associated with the second entity; determining a proportion, out of a total number of entities that are associated with the nonhuman entity, of third entities having verified attributes in relation to the particular activity, wherein the third entities include the second entity; estimating an attribute of the first entity in relation to the particular activity based on the proportion, the total number of entities that are associated with the nonhuman entity, and a degree of proximity between the first entity and the second entity; and generating an output based on the estimated attribute.
 2. The system of claim 1, wherein the respective relationships of the first entity with the one or more second entities include linking entities, each of the linking entities connecting the first entity to at least one of the one or more second entities, and each of the linking entities comprising a resource, tool, or account shared among the first entity and the at least one of the one or more second entities.
 3. The system of claim 2, wherein the instructions further cause the system to perform: determining a density metric for the first entity based on the respective relationships with the one or more second entities, the density metric being determined based on a number of relationship loops formed by the respective relationships of the first entity with the one or more second entities, each relationship loop comprising a closed cycle formed by the linking entities and at least one of the one or more second entities connected between the linking entities; determining an association metric for the first entity based on the respective status information of the one or more second entities; and providing information describing the first entity for investigation to be presented through an interface based on the density metric and the association metric.
 4. The system of claim 3, wherein the density metric is further determined based on one or more sizes of the relationship loops, the one or more sizes of the relationship loops being determined based on a number of the one or more second entities within the relationship loops, a number of the linking entities within the relationship loops, a number of edges between nodes in the relationship loops, a number of non-looping branches which extend from the relationship loops, or a length of the non-looping branches that extend from the relationship loops.
 5. The system of claim 3, wherein the association metric for the first entity is determined based on a propagation function, the propagation function being based on the degree of proximity between the first entity and the second entity identified as having the verified attribute in relation to the particular activity.
 6. The system of claim 3, wherein the association metric for the first entity is determined based on a propagation function, the propagation function being based on a proportion, in each of the relationship loops, of the one or more second entities having the verified attribute in relation to the particular activity.
 7. The system of claim 6, wherein the association metric for the first entity is further determined based on one or more weights associated with the one or more second entities, one or more weights associated with the respective relationships between the first entity and the one or more second entities, or one or more weights associated with the one or more second entities and the respective relationships between the first entity and the one or more second entities, and the instructions further cause the system to perform: assigning or changing, based on changes in the relational information, at least one of the one or more weights associated with the one or more second entities, at least one of the one or more weights associated with the respective relationships between the first entity and the one or more second entities, or at least one of the one or more weights associated with the one or more second entities and the respective relationships between the first entity and the one or more second entities.
 8. The system of claim 6, wherein the instructions further cause the system to perform: updating the association metric for the first entity based on the verified attributes of the one or more second entities in relation to the particular activity; and stopping the updating when the updating has converged.
 9. The system of claim 1, wherein the instructions further cause the system to perform presenting a build-up user interface, the build-up user interface enabling a user to: view a list of entities added to an investigation; view a list of related entities; add one or more of the related entities to the investigation; and search for a particular entity.
 10. The system of claim 1, wherein the estimating of the attribute further comprises: randomly assigning an initial measure indicative of the attribute; iteratively updating the initial measure based on one or more changes in attributes of other second entities in relation to the particular activity; and terminating the updating when the initial measure converges.
 11. The system of claim 1, wherein the instructions further cause the system to perform: receiving an indication of a new second entity having a verified attribute in relation to the particular activity; and updating the estimated attribute based on a second degree of proximity between the first entity and the new second entity.
 12. A method implemented by a computing system including one or more processors and storage media storing machine-readable instructions, wherein the method is performed using the one or more processors, the method comprising: accessing relational information, the relational information comprising, for a first entity: respective relationships with one or more second entities; and respective status information of the one or more second entities; determining a second entity, of the one or more second entities, having a verified attribute in relation to a particular activity; determining a nonhuman entity associated with the second entity; determining a proportion, out of a total number of entities that are associated with the nonhuman entity, of third entities having verified attributes in relation to the particular activity, wherein the third entities include the second entity; estimating an attribute of the first entity in relation to the particular activity based on the proportion, the total number of entities that are associated with the nonhuman entity, and a degree of proximity between the first entity and the second entity; and generating an output based on the estimated attribute.
 13. The method of claim 12, wherein the respective relationships of the first entity with the one or more second entities include linking entities, each of the linking entities connecting the first entity to at least one of the one or more second entities, and each of the linking entities comprising a resource, tool, or account shared among the first entity and the at least one of the one or more second entities.
 14. The method of claim 13, further comprising: determining a density metric for the first entity based on the respective relationships with the one or more second entities, the density metric being determined based on a number of relationship loops formed by the respective relationships of the first entity with the one or more second entities, each relationship loop comprising a closed cycle formed by the linking entities and at least one of the one or more second entities connected between the linking entities; determining an association metric for the first entity based on the respective status information of the one or more second entities; and providing information describing the first entity for investigation to be presented through an interface based on the density metric and the association metric.
 15. The method of claim 14, wherein the density metric is further determined based on one or more sizes of the relationship loops, the one or more sizes of the relationship loops being determined based on a number of the one or more second entities within the relationship loops, a number of the linking entities within the relationship loops, a number of edges between nodes in the relationship loops, a number of non-looping branches which extend from the relationship loops, or a length of the non-looping branches that extend from the relationship loops.
 16. The method of claim 15, wherein the association metric for the first entity is determined based on a propagation function, the propagation function being based on the degree of proximity between the first entity and the second entity identified as having the verified attribute in relation to the particular activity.
 17. The method of claim 15, wherein the association metric for the first entity is further determined based on a propagation function, the propagation function being based on a proportion, in each of the relationship loops, of the one or more second entities having the verified attribute in relation to the particular activity.
 18. The method of claim 17, wherein the association metric for the first entity is further determined based on one or more weights associated with the one or more second entities, one or more weights associated with the respective relationships between the first entity and the one or more second entities, or one or more weights associated with the one or more second entities and the respective relationships between the first entity and the one or more second entities and the instructions further cause the computing system to perform: assigning or changing, based on changes in the relational information, at least one of the one or more weights associated with the one or more second entities, at least one of the one or more weights associated with the respective relationships between the first entity and the one or more second entities, or at least one of the one or more weights associated with the one or more second entities and the respective relationships between the first entity and the one or more second entities.
 19. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform: accessing relational information, the relational information comprising, for a first entity: respective relationships with one or more second entities; and respective status information of the one or more second entities; determining a second entity, of the one or more second entities, having a verified attribute in relation to a particular activity; determining a nonhuman entity associated with the second entity; determining a proportion, out of a total number of entities that are associated with the nonhuman entity, of third entities having verified attributes in relation to the particular activity, wherein the third entities include the second entity; estimating an attribute of the first entity in relation to the particular activity based on the proportion, the total number of entities that are associated with the nonhuman entity, and a degree of proximity between the first entity and the second entity; and generating an output based on the estimated attribute.
 20. The medium of claim 19, wherein the respective relationships of the first entity with the one or more second entities include linking entities, each of the linking entities connecting the first entity to at least one of the one or more second entities, and each of the linking entities comprising a resource, tool, or account shared among the first entity and the at least one of the one or more second entities. 